Add asset metadata, sharing, and MinIO-backed signed links.

This introduces deduplicated per-user image/3D asset records linked into feature properties, adds visibility-controlled download routing, and wires local S3-compatible storage with automatic bucket bootstrap in Docker Compose.

Made-with: Cursor

cmd/api/main.go

@@ -4,11 +4,13 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
 	"momswap/backend/internal/app"
 	httpapi "momswap/backend/internal/http"
+	"momswap/backend/internal/storage"
 	"momswap/backend/internal/store"
 )
 
@@ -47,6 +49,11 @@ func main() {
 		SessionTTL:   24 * time.Hour,
 	}, servicePublicKey)
 	service.BootstrapAdmin(adminPublicKey)
+	if signer, err := newAssetSignerFromEnv(); err != nil {
+		log.Printf("asset storage disabled: %v", err)
+	} else if signer != nil {
+		service.ConfigureAssetStorage(signer)
+	}
 
 	api := httpapi.NewAPI(service)
 	log.Printf("listening on %s", addr)
@@ -55,6 +62,35 @@ func main() {
 	}
 }
 
+func newAssetSignerFromEnv() (app.AssetURLSigner, error) {
+	endpoint := os.Getenv("S3_ENDPOINT")
+	bucket := os.Getenv("S3_BUCKET")
+	if endpoint == "" || bucket == "" {
+		return nil, nil
+	}
+	useTLS, err := strconv.ParseBool(getEnv("S3_USE_TLS", "false"))
+	if err != nil {
+		return nil, err
+	}
+	usePathStyle, err := strconv.ParseBool(getEnv("S3_USE_PATH_STYLE", "true"))
+	if err != nil {
+		return nil, err
+	}
+	signer, err := storage.NewS3Signer(storage.S3Config{
+		Endpoint:  endpoint,
+		Region:    getEnv("S3_REGION", "us-east-1"),
+		Bucket:    bucket,
+		AccessKey: getEnv("S3_ACCESS_KEY", ""),
+		SecretKey: getEnv("S3_SECRET_KEY", ""),
+		UseTLS:    useTLS,
+		PathStyle: usePathStyle,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return signer, nil
+}
+
 func getEnv(key, fallback string) string {
 	v := os.Getenv(key)
 	if v == "" {